"WordPress is slow" is a symptom. We sell the diagnosis.
Real diagnostic engineering, not a caching-plugin install. We read the nginx logs, profile PHP-FPM, analyse the slow queries, audit the plugins, then we fix what is actually wrong.
Two hours into a recent diagnostic: not a caching problem. An ASN-level Cloudflare block plus backdoor remediation restored service.
/var/log/nginx/access.log, anonymised
Case 2024
# normal traffic 2024-XX 03:14:22 "GET /boiler-cover/ HTTP/2" 200 28102 "..." 0.34 2024-XX 03:14:22 "GET /assets/main.css HTTP/2" 200 14201 "..." 0.02 # attack starts, PHP-FPM exhausted 2024-XX 03:18:01 "GET /boiler-cover/?v=8a3f HTTP/2" 504 - "..." 30.00 2024-XX 03:18:01 "GET /boiler-cover/?v=2c7e HTTP/2" 504 - "..." 30.00 2024-XX 03:18:02 "POST /wp-load.php?x=4d HTTP/2" 200 1 "..." 0.41 <-- backdoor poll 2024-XX 03:18:02 "POST /v1/wp-load.php?z=a9 HTTP/2" 200 1 "..." 0.39
Before / after
Real numbers from a recent engagement
deferred non-critical JS, WebP pipeline, ISR-equiv cache, edge revalidation
pool tuning, fastcgi_read_timeout reduced, Cloudflare absorbing bot traffic
object cache (Redis), removed un-indexed plugin queries, transient cleanup
plugin compatibility pass, deprecation review, staged rollout
Things plugins quietly do to your performance
Six common culprits we've fixed in production
AutomateWoo bundles its own Guzzle
Conflicts with other plugins. The fix is keeping migration / cron scripts WP-free.
WPML doubles payment gateways on multilingual checkout
Symptom: duplicate card fields. Root cause: wp_loaded patch missing.
Themes with un-indexed SQL queries
Linear scaling with post count. Visible only at 10K+ posts. Fix: EXPLAIN, add indexes.
ACF on every page load with no cache
Costs ~50ms per uncached request. Object cache + selective wrapper functions.
Cart fragments on every page (Woo)
AJAX heartbeat killing TTFB on non-cart pages. Conditional load.
Autoload bloat in wp_options
MBs of option_value autoloaded on every request. Audit + remove.
What you get
Seven engagements
Server diagnosis
nginx logs, PHP-FPM pool tuning, slow query log, MySQL EXPLAIN analysis.
PHP upgrades 7.x to 8.x
Plugin and theme compatibility work that comes with them.
Cache strategy (multi-layer)
Object cache (Redis / Memcached), page cache (WP Rocket / LiteSpeed), Cloudflare edge rules.
Plugin audit
Identifying which plugins are quietly eating performance. Replace, remove, or fix.
Database optimisation
Autoload bloat, transient cleanup, orphaned postmeta, missing indexes.
Core Web Vitals
LCP under 2s, CLS under 0.1, INP under 200ms. Inside WordPress, not by abandoning it.
WooCommerce performance
Cart fragments, AJAX bloat, checkout query reduction, supplier-feed caching.
The performance stack audit
Where the seconds actually go
Eleven layers of a slow WordPress page load. Typical millisecond budget on the left, where we usually find the problem on the right.
Cloudflare resolves fast; legacy DNS providers don't.
HTTP/3 + 0-RTT on Cloudflare; older origins are slower.
Where we want most requests to terminate.
Wrong cache keys land here.
Healthy. Slow logs mean an upstream PHP-FPM problem.
0 is healthy. Seconds means the pool is exhausted.
Where most fixable time lives.
EXPLAIN + indexes. Un-indexed queries scale linearly.
Gzip / brotli compression.
Image pipeline, defer non-critical JS, font display swap.
CLS fixes, hydration cost on heavy themes.
Good fit if
When a performance review is worth it
- WordPress / WooCommerce sites with Speed scores under 50 and a real revenue downside
- Stores with PHP-FPM exhaustion, nginx upstream timeouts, or unexplained traffic-driven outages
- Sites on EOL PHP versions where the upgrade itself is the performance project
- Operators tired of caching-plugin advice that didn't actually fix the underlying problem
Probably not a fit
When the problem isn't really performance
- Brand-new sites with no real users yet, where this is premature optimisation
- Pure marketing sites where Speed 90 is achievable with WP Rocket in an afternoon
- Buyers expecting the bottleneck to be solved by a plugin install (it isn't)
Pair with maintenance and support for ongoing patching, Cloudflare edge engineering for the cache rules, security work when the slowness has a security cause, and technical SEO for the Core Web Vitals side that affects rankings.
Tools we use
Boring, deliberate, runbook-driven
Diagnose first
Bring the URL, the speed test, and access to the nginx logs.
More in WordPress
Web & SaaS
Mobile Apps
E-commerce & Payments
WordPress
- Custom WordPress Development
- Headless WordPress & WooCommerce
- Custom WordPress Plugin Development
- WordPress Performance Optimisation
- WordPress Security & Malware Removal
CMS & Platforms
37 services across 7 practice areas.